Web Analytics
Matomo
Rest of world Report an error0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by InnoCraft Ltd · matomo.org
Compare with Piwik PRO Analytics Suite → Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Matomo at a glance
- Vendor
- InnoCraft Ltd
- Headquarters
- Not stated on the vendor’s pages as of 1 Nov 2026
- Data hosting
- Default not stated; pages mention Europe source, captured 29 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 1 Nov 2026
- Panel verdict
- The AI panel rates Matomo 4/5, the mean of 6 judges. Matomo is web analytics from InnoCraft Ltd, sold as Matomo Cloud or free GPL on-premise download. how scores are made
- As of
- Vendor pages captured 29 Oct 2026 to 1 Nov 2026; evaluated by the panel 30 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Matomo is web analytics from InnoCraft Ltd, sold as Matomo Cloud or free GPL on-premise download. Data ownership leads at 9: self-hosting on your own MySQL with SQL access and no data limit, APIs in CSV, JSON and XML, warehouse export to BigQuery and Snowflake. Traffic reporting and consent and privacy cluster at 8-9, implementation at 7-9, conversions and events at 7-8, attribution and cohorts as premium add-ons. Judges flag the same gaps: unpublished visitor-counting methodology, script size and status page with uptime history. Pricing transparency is the weak point at 7: the Business plan is public at 22 EUR per month (excl. tax) with overage at 5,000 hits for 2.2 EUR (excl. tax) and a 21-day trial without credit card, but captured pages show a single tier price, no minimum term and no premium-plugin prices. Sovereignty scores 7-8: cloud data sits on AWS in Frankfurt, stated as not transferred to the US, but the contracting entity is in New Zealand and US providers run support and payments; on-premise keeps data in a country of your choice, subprocessors not applicable.
Speaks for it
- On-premise edition is GPL-licensed and free to download, running on your own MySQL with SQL access and no data limit
- Reporting and administration APIs return data in CSV, JSON and XML, with a Data Warehouse Connector to BigQuery and Snowflake
- CNIL approval for consent-free collection, with a one-click CNIL configuration and a published self-assessment
- Installation is documented from one-click installers and Docker to official WordPress and shop-system plugins, plus a first-party tracker proxy
- Termination terms document export within the 30-day window, deletion within 30 days and backups retained for up to 60 days
Held against it
- Captured pricing pages show a single tier price, with no full tier ladder, no minimum term and no premium-plugin prices
- We found no public information on tracking script size, measured performance impact or a status page with uptime history
- We found no public information on a published methodology for how visitors are counted or on configurable channel grouping
- The vendor recommends consent before cookieless or cookie-based tracking under German law, and the BfDI requires consent for the bodies it supervises
- Cloud contracting runs through InnoCraft Ltd in New Zealand, with Help Scout in the USA handling support emails and Paddle in the UK and USA handling payments
Best for
- You want to own the analytics stack outright — data ownership scores sit at 9, carried by the on-premise edition with SQL access, no data limit and migration between Cloud and On-Premise in both directions
- You want banner-free analytics in France under the CNIL exemption, using the one-click configuration and the opt-out mechanism
- You are an agency or reseller managing many client sites, using white-label resale, per-website user access and official plugins for WordPress and shop systems
- You need raw events in your own warehouse, via the Data Warehouse Connector from 5 EUR per month
Avoid if
- You must compute a full annual cost before committing — the captured pages show a single tier price, no minimum term and no premium-plugin prices
- You are a Cloud buyer requiring an end-to-end European chain, since the contracting entity is in New Zealand and US providers run support and payments
- You need banner-free analytics in Germany, where the vendor recommends consent before tracking and e-commerce, heatmaps, session recording and raw data access fall outside the CNIL exemption
- Your Cloud plan must keep raw data beyond 24 months, the Business plan's stated raw-data retention, while report data is kept forever
The scores
| Criterion | Panel median |
|---|---|
| Traffic, sources & campaign reports | 4 of 5 |
| Goals, events, funnels & e-commerce | 4 of 5 |
| Consent-free operation & data minimisation | 4 of 5 |
| Data access, export & self-hosting | 4.5 of 5 |
| Installation, integrations & performance | 4 of 5 |
| European sovereignty | 4 of 5 |
| Pricing transparency | 3.5 of 5 |
Traffic, sources & campaign reports
Show reasoningHide reasoning
How this is scored
What the standard reports show: page views, visits and visitors, entry and exit pages, referrers, search engines and social networks as sources, campaigns tagged with UTM parameters, countries, devices and browsers, a real-time view, date comparisons, segments and filters, custom dashboards, scheduled email reports, shared or public dashboards, and whether reports are sampled or complete.
0 — Not a web analytics product; website traffic cannot be measured with it.
3 — Page views and visitors over time with top pages and referrers; campaign parameters, segments and report sharing are basic or not described.
5 — A dashboard with pages, referrers, UTM campaigns, countries and devices, a real-time view, date comparison, filters across all reports, email reports, and dashboards shared with clients or colleagues.
8 — Custom segments and saved views, custom dashboards and report builders, channel grouping that can be configured, Search Console or ad platform data shown beside the traffic, unsampled reports stated, several sites and roll-up reporting in one account, and annotations.
10 — Reporting that a whole organisation runs on: custom dimensions and calculated metrics, anomaly alerts, multi-site and multi-brand roll-ups with roles per site, report accuracy and how visitors are counted explained in a published methodology, and every report reproducible from the raw data.
The E-Commerce Marketing Lead
The standard reports give me everything my dashboards need — top pages, entry and exit pages, referrers, search engines and social, countries, devices and browsers — with campaign tracking that auto-detects Google Analytics parameters, custom segments using over 110 conditions, custom dashboards, scheduled email reports, annotations, an All Websites dashboard plus paid roll-up reporting, and unsampled data stated outright. Search Console keywords can even be imported into the referrer reports. I found no published methodology for how visitors are counted, which is the only thing keeping me a step below the top. 1 2 6 7 9 10
The Data Protection Officer
The standard reports cover top pages and URLs, entry and exit pages, search engines (more than 800), social networks, campaigns, countries, devices and browsers, with a real-time visits log, map and visitor counter, custom segments built from over 110 conditions, custom dashboards, custom dimensions and metrics, roll-up reporting across sites, annotations, unsampled data stated, and Search Console keywords importable alongside the traffic. The captured pages give no published methodology for how visitors are counted and no configurable channel grouping, which is what keeps it off the top level. 2 6 7 9 10
The Agency Developer
Thirty-plus standard reports cover pages, referrers, search engines and social, countries, devices and entry/exit pages, with real-time visits log and map, segments on over a hundred conditions, customisable dashboards, scheduled email and Slack reports, annotations, and no sampling stated; Search Console keyword import and premium roll-up reporting for several sites in one account round it out. We found no public information on a published methodology explaining how visitors are counted, which keeps this below the top level. 2 6 7 9 10 15
The Growth Analyst
Standard reports cover referrers, search engines, social, entry and exit pages, campaigns, countries, devices and browsers, with segmentation on over 110 conditions, custom dashboards, annotations, scheduled email reports, Search Console keyword import, unsampled data, and roll-up reporting across unlimited websites; real-time comes as a visits log, live view and world map. The referrer and campaign depth plus saved segments is exactly what we need to trace a signup back to its first click. I hold just below the top because we found no published methodology on how visitors are counted and no description of configurable channel grouping. 2 6 7 9 10
The Public-Sector Site Owner
The standard reports list top pages, entry and exit pages, referrers across more than 800 search engines and social networks, countries, devices, browsers and campaigns, with a real-time map and counter, custom segments from over 110 conditions, custom dashboards, scheduled email reports, annotations, roll-up reporting across many sites and Search Console keyword import, and an explicit statement of no data sampling. I found no published methodology for how visitors are counted and no configurable channel grouping, so it stays just below the top level. 2 6 7 10
The Skeptic
Thirty-plus standard reports covering referrers, 800-plus search engines, entry and exit pages, countries, devices, engagement and top campaigns sit beside custom segments on over 110 conditions, customisable dashboards, a Custom Reports builder, annotations, an All Websites Dashboard, paid roll-up reporting and an explicit no-sampling statement, with Google Search Console keywords importable alongside. What I did not find on the captured pages is a published methodology for how visitors are counted or configurable channel grouping. 2 6 7 9 10 12
Goals, events, funnels & e-commerce
Show reasoningHide reasoning
How this is scored
How the product measures what visitors do: goals for pages and events, custom events with properties, outbound links, downloads, form submissions and scroll depth tracked without code, funnels with drop-off, e-commerce tracking of orders, revenue and products, attribution of conversions to channels and campaigns, cohorts and retention, and conversion data passed back to ad platforms.
0 — Counts page views only; no goals, events or conversions can be defined.
3 — Goals for a page or a custom event; funnels, revenue and attribution are basic or not described.
5 — Goals and custom events with properties, outbound links and file downloads tracked, funnels with drop-off per step, revenue attached to goals or orders, and conversions broken down by source and campaign.
8 — Full e-commerce tracking (products, cart, checkout, orders, revenue) with plugins for named shop systems, several attribution models compared, cohorts and retention, user journeys or paths, forms and scroll depth tracked without code, and conversions sent back to Google Ads, Meta or other ad platforms server to server.
10 — Conversion analysis to the level of a product analytics suite: multi-touch attribution explained, funnels and cohorts on any event or property, revenue reconciled with the shop system, predictive or anomaly metrics with their method stated, and every conversion traceable to the raw event.
The E-Commerce Marketing Lead
E-commerce tracking is included in every plan and the integration directory names WooCommerce, Shopify and shopware — my shop system — while the paid funnels plugin shows where visitors drop off per step and can be segmented by marketing campaign. Events cover clicks, video plays, downloads and form submissions, cohorts and multi-channel attribution are documented, and an Advertising Conversion Export names Google Ads, Bing Ads and Yandex Ads. I found no public information on sending conversions back to Meta, or on reconciling revenue with the shop backend. 2 5 6 11 12
The Data Protection Officer
Goals and custom events with properties, automatic tracking of file downloads, external links and 404 pages, funnels with drop-off per step, segmentation by funnel step and historical backfill, full e-commerce with plugins for WooCommerce, Magento, PrestaShop, Shopify and Shopware, multi-channel attribution, cohorts, user flow, and an advertising conversion export covering Google, Bing and Yandex. The captured pages do not compare several attribution models side by side, and we found no public information on predictive or anomaly metrics with their method stated. 2 5 11 12
The Agency Developer
Goals, custom events, automatic download and outbound-link tracking, and funnels with drop-off, historical backfill and segment overlays are documented, alongside shop plugins for WooCommerce, Shopify, Shopware, Magento and PrestaShop; multi-channel attribution, user flows, cohorts and an advertising conversion export for Google and Bing Ads exist as premium features. We found no public information on conversions being sent back to ad platforms server to server. 2 5 6 11 12
The Growth Analyst
Goals, custom events with dimensions, automatic download and outbound-link tracking and unusually deep funnels (multiple funnels per goal, historical backfill, segmenting by campaign, step-level time analysis) are all documented, alongside e-commerce tracking with plugins for eight named shop systems including WooCommerce and Shopify. Attribution and cohorts exist as premium add-ons (Multi Channel Conversion Attribution, User Cohorts) and advertising conversion export covers Google, Bing and Yandex, but we found no public information comparing attribution models or describing server-to-server conversion transfer. Strong enough to follow a visitor from campaign click to revenue, which is my core requirement. 2 5 11 12
The Public-Sector Site Owner
Goals, events covering clicks, video plays, downloads and form submissions, automatic download and outbound-link tracking, and a funnels product with per-step drop-off, segmentation by funnel step, validation and historical backfill are documented, alongside e-commerce analytics with plugins for WooCommerce, Magento, PrestaShop, Shopify and shopware, multi-channel attribution, user cohorts and a Form Analytics feature showing where visitors leave forms — the abandonment view our public service forms need. The captured pages do not show conversions being sent back to ad platforms server to server, which keeps it below the very top level. 2 5 11 12
The Skeptic
Goals, custom events, automatic download and outbound-click tracking, funnels with per-step drop-off, segmentation by funnel step and historical backfill are all documented, alongside e-commerce tracking with plugins for named shop systems including WooCommerce, Shopify, Shopware and Magento. Multi-channel attribution, cohorts, user flow, form and media analytics and an Advertising Conversion Export covering Google Ads, Bing and Yandex are premium features; whether conversions go back to ad platforms server to server is not stated. 2 5 11 12
Consent-free operation & data minimisation
Show reasoningHide reasoning
How this is scored
What is collected and whether a consent banner is needed: a cookieless mode with how visitors are counted (daily hash, server-side fingerprint, no identifier), IP addresses truncated or not stored, no cross-site or cross-device profile and no use of data for the vendor's own purposes, data retention settings, opt-out and Do Not Track, a consent mode for features that do need consent, the vendor's stated reading of §25 TDDDG, the CNIL consent exemption and the authorities' rulings on Google Analytics, and guidance for the site's privacy policy. Where the data is processed is scored under sovereignty.
0 — Requires consent for every visit and sets tracking cookies with no privacy settings at all, or shares visitor data for advertising by default.
3 — IP anonymisation or a cookie setting exists and the product is described as GDPR-compliant; how visitors are identified, retention and the consent position are basic or not described.
5 — A documented cookieless or consent-free mode that states how visitors are counted, IP addresses truncated before storage, no cross-site tracking, retention configurable, an opt-out, a consent mode for the features that need one, and a data protection page explaining when a banner is required.
8 — The consent position stated against named law (§25 TDDDG, the ePrivacy Directive, the CNIL exemption or a DPA ruling), identifiers rotated or never created and the method published, personal data never stored by default, pseudonymisation and retention settings per data type, a legal opinion or external audit of the consent-free mode cited, and wording for the privacy policy supplied.
10 — Data minimisation that can be verified: the collection script and processing open to inspection, exactly which fields are stored documented, a consent-free mode recognised by a named authority or certified, accuracy with and without consent stated, and every privacy setting the customer controls listed with its effect.
The E-Commerce Marketing Lead
The consent position is argued against named law: CNIL approval as one of the few tools usable without tracking consent, a one-click CNIL configuration, a TDDDG FAQ and the BfDI guideline, plus a published self-assessment against the CNIL criteria. Operationally there is opt-out tracking with a visitor opt-out form, cookieless tracking, IP anonymisation up to storing no IP at all, configurable retention, pseudonymisation features, a GDPR Manager and privacy-policy wording guides. For my German shop specifically the vendor recommends consent before tracking under German law, and e-commerce tracking, advertising conversion and raw data access fall outside the CNIL exemption — so consent-free does not cover my revenue data. 2 3 8 13 14
The Data Protection Officer
The consent position is written against named law: CNIL recognition as usable without tracking consent, a self-assessment against the CNIL exemption criteria with the excluded features listed, and a stated §25 TDDDG reading recommending consent in Germany with log-file analytics offered as the route that touches no terminal device — plus IP anonymisation or no IP storage at all, pseudonymisation settings, configurable retention, Do Not Track, an opt-out form, and privacy-policy wording guides. What the captured pages do not give me is the published method by which a visitor is counted in cookieless mode or a field-by-field list of what is stored, so I cannot sign off a banner-free site outside the log-analytics route. 2 3 4 8 13 14
The Agency Developer
A cookieless mode with the option to store no IP address at all, an opt-out iframe, Do Not Track support, configurable retention, pseudonymisation from IP masking to User ID hashing, a TDDDG guide, a CNIL exemption configuration with a published self-assessment, and supplied privacy-policy wording make this the deepest consent story I have scored. The vendor states CNIL approval for tracking without consent; the German guidance page takes a stricter reading for the bodies that authority supervises, so German client cases still need separate review. 2 3 8 13 14
The Growth Analyst
The consent position is argued against named law on every front: CNIL approval to collect without tracking consent, a TDDDG configuration guide reflecting the BfDI position, three documented tracking modes (opt-out, consent-based, adaptive), an opt-out iframe, Do Not Track support and a published self-assessment against the CNIL exemption criteria. IP anonymisation or no IP storage at all, cookieless operation, pseudonymisation features, customer-configurable retention and a GDPR Manager covering data-subject rights are all evidenced, and the open-source script can be inspected. Docked from the top because we found no public statement on accuracy with versus without consent, nor a field-by-field list of exactly what is stored. 2 3 8 13 14
The Public-Sector Site Owner
Banner-free operation is thoroughly documented: cookieless tracking with all cookies disableable, IP anonymisation or no IP storage at all, a no-PII configuration, customer-configurable retention, Do Not Track, an opt-out iframe and form, a one-click CNIL exemption configuration with a published self-assessment, CNIL approval to collect without tracking consent, and guides for privacy notice wording. I must flag two captured facts for German practice: the vendor recommends consent before cookieless or cookie-based tracking under German law, and the BfDI guideline requires consent for the bodies it supervises — though log-file analytics without terminal-device access is offered as a consent-free alternative with a limited report set. 2 3 8 13 14
The Skeptic
A CNIL approval for consent-free use, a one-click CNIL configuration, and — rare honesty — the exemption's boundaries spelled out: heatmaps, User ID, e-commerce, advertising conversion, session recording and raw data access need consent. Opt-out iframe and Do Not Track, IP anonymisation or no IP storage at all, configurable retention, pseudonymisation features and privacy-policy wording guides are documented; note the German FAQ instead recommends consent before even cookieless tracking, and the BfDI requires consent for the bodies it supervises. The captured pages do not publish how cookieless visitors are counted or exactly which fields are stored per visit. 2 3 8 13 14
Data access, export & self-hosting
Show reasoningHide reasoning
How this is scored
Whether the data stays the customer's and can leave with them: a reporting API and a raw event export, CSV export of every report, a scheduled export or sync to a data warehouse or BI tool (BigQuery, Snowflake, Looker Studio), no data sampling or limits on history, import of historical data from Google Analytics or another tool, open-source code, and a self-hosted or on-premise edition the customer runs on its own servers.
0 — No export of any kind; the data can only be viewed in the vendor's dashboard.
3 — A CSV export of reports; an API, raw data and history limits are basic or not described.
5 — A documented reporting API, CSV export of all reports, the retention period for raw data stated, and an import of historical data from Google Analytics or a stated migration path.
8 — Raw event data exportable or streamed to a named warehouse or BI tool, an API covering both reporting and data collection, no sampling stated, a self-hosted or on-premise edition with its own documentation, and the data returned or deleted on termination under stated terms.
10 — The customer owns the data end to end: open-source code under a named licence that runs fully self-hosted with feature parity stated, a complete raw export in an open format that another tool can import, and the deletion of every copy on termination documented.
The E-Commerce Marketing Lead
The code is open source under GPL, free to download and self-hostable with no data limit, backed by raw data export, a reporting and tracking API in CSV, JSON and XML, direct SQL access, an official connector for BigQuery and Snowflake, historical Google Analytics import, and bidirectional migration between Cloud and On-Premise. The data processing agreement promises export until 30 days after termination and deletion within 30 days, with backups purged after 60. Feature parity between the editions is only partly described — Cloud is described as partially extensible — which keeps me just short of a perfect score. 2 4 6 8 15
The Data Protection Officer
The data can leave with the customer and mostly already belongs to them: a GPL-licensed on-premise edition the customer runs itself with unlimited retention, reporting and administration APIs returning CSV, JSON and XML, raw data export and a warehouse connector into BigQuery and Snowflake, direct SQL access, historical Google Analytics import, cloud-to-on-premise migration in both directions, and documented deletion within 30 days of termination with backups purged within 60. We found no public information stating feature parity between the cloud and self-hosted editions, which is the one gap before full end-to-end ownership. 2 4 6 7 8 15 17
The Agency Developer
Everything I install stays mine: a GPL-licensed on-premise edition with no data limit, SQL access to the raw database, reporting, collection and administration APIs, raw export into BigQuery and Snowflake plus Looker Studio, Tableau and Power BI connectors, a Google Analytics history import, and thirty-day deletion with a pre-termination export documented in the DPA. The only ceiling the pages show is cloud raw-data retention of 24 months; on-premise keeps data forever. 2 4 6 7 8 15 17
The Growth Analyst
This is the strongest area for my needs: GPL-licensed open source self-hosted on our own MySQL with SQL query access and no data limits, a full reporting and management API in CSV, JSON and XML, historical Google Analytics import, and a Data Warehouse Connector for BigQuery and Snowflake, so nightly raw events in our warehouse are a real option rather than a migration risk. Cloud-to-On-Premise migration is bidirectional, and on termination export within 30 days and deletion within 30 days (backups up to 60 days) are documented in the DPA. The cautions are the Cloud plan's 24-month raw data retention and that the warehouse connector is an add-on starting from 5 EUR per month. 2 4 6 7 8 15
The Public-Sector Site Owner
The On-Premise edition is open source under the GPL licence, free forever, runs on our own MySQL database with no storage limits, and subprocessors are explicitly not applicable to it; the APIs return visitor-level data in CSV, JSON and XML, raw data can flow to BigQuery or Snowflake or be queried in SQL, historical Google Analytics data can be imported, migration works in both directions, and the data processing agreement promises deletion within 30 days of termination with export rights during that window. In the Cloud plan raw data is kept 24 months while report data is kept forever, which I note for long-range planning. 2 4 6 8 15
The Skeptic
The exit is real: raw data export, a reporting API in CSV, JSON and XML for any site and period, a Data Warehouse Connector for BigQuery and Snowflake, Google Analytics history import, and documented migration in both directions between Cloud and a GPL-licensed self-hosted edition with SQL access to your own database. On termination, deletion within thirty days, exports within that window, and encrypted backups persisting up to sixty days are stated plainly. Cloud raw-data retention is 24 months while the self-hosted edition is unlimited — a documented difference, not a hidden one. 2 4 6 8 15
Installation, integrations & performance
Show reasoningHide reasoning
How this is scored
What it takes to install and run: the size and loading of the tracking script, plugins and documented set-ups for named CMS and shop systems (WordPress, TYPO3, Shopify, Shopware, WooCommerce), single-page apps and mobile SDKs, a tag manager or Google Tag Manager template, server-side tracking and first-party proxying to avoid ad blockers, team roles and permissions, client and agency accounts, single sign-on, and an uptime or status page.
0 — No documented way to install the product on a website or app.
3 — A tracking snippet to paste into the site; plugins, SDKs, server-side options and roles are basic or not described.
5 — A documented snippet with its size stated, plugins or guides for several named CMS and shop systems, support for single-page apps, team members with roles, and an agency or multi-site account.
8 — A lightweight script or server-side collection documented, a first-party proxy or own tracking domain, SDKs for iOS, Android and named frameworks, a tag manager integration, granular roles per site, single sign-on (SAML), and a public status page with uptime history.
10 — Installation that scales across an organisation: server-side and client-side tracking with an equal feature set, an infrastructure-as-code or API-driven site set-up, white-label for agencies, SLA and support terms published, and the performance impact of the script measured and stated.
The E-Commerce Marketing Lead
Setup is one line of JavaScript or plugins for WordPress, TYPO3 and 100+ technologies including shopware, with a five-minute install, Softaculous, Installatron, a Debian package and an official Docker image, plus step-by-step guides and official iOS and Android SDKs. There is a Matomo Tag Manager, a Google Tag Manager template, and a documented tracker proxy that routes collection through my own domain, alongside per-website user access, SAML single sign-on and two-factor authentication. I found no public information on the tracking script's size, its measured performance impact, or a public status page with uptime history. 1 2 5 7 17 18
The Data Protection Officer
A JavaScript tag with documented placement, a five-minute install plus Softaculous, Installatron, a Debian package and an official Docker image, step-by-step guides for WordPress, Joomla, Webflow, Shopify, Wix and more, iOS and Android SDKs, Matomo Tag Manager and a Google Tag Manager template, SAML and LDAP single sign-on, granular multi-user access to multiple websites, and a documented first-party tracker proxy routing collection through the customer's own domain. We found no public information on script size or measured performance impact, a public status page, or published SLA and support terms tied to installation. 2 5 7 17 18
The Agency Developer
For my stack this covers everything: official plugins for WordPress, TYPO3, WooCommerce and Shopify, installation documented from one-click installers and Docker to a five-minute manual set-up, iOS and Android SDKs, a Matomo Tag Manager plus a Google Tag Manager route, unlimited users with per-site access, white-label for reselling to clients, and a documented tracker proxy so tracking runs through the client's own domain. We found no public information on script size or a public status page with uptime history. 2 5 6 17 18
The Growth Analyst
Installation is documented from every angle: a JavaScript tag, 5-minute and one-click installs (Softaculous, Installatron, Debian package), a WordPress plugin, a Docker image with GPG signatures, and step-by-step guides for CMS and shop systems including WordPress and TYPO3. Official iOS, Android, PHP, Java and C++ SDKs, Matomo Tag Manager plus Google Tag Manager including a server-side variant, SAML single sign-on, and a documented Tracker Proxy to serve tracking from your own domain against blockers. We found no public information on script size, a status page with uptime history, or the measured performance impact of the script. 2 5 17 18
The Public-Sector Site Owner
A five-minute install with one-click options for Softaculous, Installatron and a Debian package, official plugins for WordPress, Joomla, TYPO3, Drupal and the major shop systems, official iOS and Android SDKs, LDAP and SAML login, a Docker image with GPG-signed releases, and a thoroughly documented first-party tracker proxy with authentication and subdomain guidance give a realistic path inside the municipal data centre. I found no published script size, no status page with uptime history and no SLA, and single-page-app support is not explicitly named on the captured pages. 2 5 17 18
The Skeptic
A one-line JavaScript tag, five-minute install with Softaculous, Installatron and Debian options, a WordPress plugin, guides for nine named systems, iOS and Android SDKs, a tag manager plus a Google Tag Manager template, SAML and LDAP SSO, 2FA, a Docker image and a properly documented first-party Tracker Proxy on your own domain. The captured pages do not show the tracking script's size or measured performance impact, single-page-app handling, or a public status page with uptime history. 1 2 5 7 15 17 18
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where visitor data is collected, stored and processed, and who the subprocessors are (script CDN, collection endpoint, hosting, email reports, support and payment tools). Independently sourced by the sovereignty pipeline; visitor data is personal data under European rulings, so the whole chain counts, not only the database. A self-hosted or open-source edition the customer runs on its own European servers counts as the customer's chain, whatever the vendor's seat.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors unnamed, and no data processing agreement offered.
3 — A privacy policy and a data processing agreement exist, but hosting location is unstated or non-EU and the subprocessors are not listed.
5 — EU hosting available and an EU contracting entity or EU representative, but parts of the chain (CDN, collection endpoint, email, support, payment) run through non-EU providers without a stated safeguard, or EU processing relies on a proxy in front of a non-EU service.
8 — EU hosting on named infrastructure, EU contracting entity, subprocessors listed with their locations, a data processing agreement published, and security certifications (ISO 27001, SOC 2) stated — or a self-hosted edition documented that keeps every visitor record on the customer's own servers.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and every subprocessor, or a self-hosted open-source edition with no call home, data export and deletion documented, and certifications published with their scope rather than implied.
The E-Commerce Marketing Lead
The contracting entity is InnoCraft in New Zealand under the EU adequacy decision, with a Hamburg data protection officer and an EU representative, and Matomo Cloud runs on AWS in Frankfurt with backups in Dublin under a published data processing agreement and ISO 27001 certification; subprocessors such as Help Scout in the USA, Paddle in the UK and USA, and HubSpot with EU hosting configured are listed with their locations. Beyond the cloud, the documented On-Premise edition keeps every visitor record on my own servers in a country of my choice, where the subprocessor list does not apply — for my shop that means self-hosting in Germany is the fully sovereign route. The remaining caveat for Cloud buyers is a US-headquartered host and non-EU support and payment services in the chain. 3 4 6 7 8
The Data Protection Officer
Cloud data sits on named infrastructure in Frankfurt with backups in Dublin, stated as not transferred to the US; the subprocessor list is published with locations and includes US-based processors such as Help Scout for support and Paddle for payments, governed by a published Article 28 DPA with SCCs and the New Zealand adequacy decision; an EU representative sits in Hamburg, ISO 27001:2022 is stated, and the open-source on-premise edition keeps every visitor record on servers of the customer's choosing. The contracting entity is in New Zealand and the hosting chain rests on a US-headquartered provider subject to the CLOUD Act, so European ownership end to end is not established on the captured pages. 3 4 7 8 17
The Agency Developer
The cloud is documented on named EU infrastructure — AWS Frankfurt with Dublin backups, and the statement that cloud data is not transferred to the US — backed by a subprocessor list with locations, a published DPA and ISO 27001; the contracting entity sits in New Zealand under an adequacy decision with an Article 27 EU representative and a Hamburg DPO, and US-headquartered providers appear in the hosting, support and payment chain. The documented on-premise edition keeps every visitor record on servers the customer chooses, which is the chain I would sell to German clients. 3 4 6 7 8
The Growth Analyst
Cloud data sits in Frankfurt with backups in Dublin on AWS, a data processing agreement and subprocessor list are published, ISO 27001 is certified, and an EU representative and a Hamburg Data Protection Officer are named — though the contracting entity is InnoCraft Ltd in New Zealand under an adequacy decision, and the subprocessor chain includes US legs such as Help Scout for support and Paddle for payments. The documented self-hosted edition, where data lands in the country of our choice and no subprocessors apply, is what makes this workable for a Munich buyer with data-residency obligations. For Cloud buyers the hosting is European but the chain is not end-to-end European. 3 4 6 7 8
The Public-Sector Site Owner
For the cloud edition the hosting is named — AWS in Frankfurt with backups in Dublin, with the vendor stating no data is transferred to the US — plus an EU representative in Germany, a published Article 28 DPA, ISO 27001 certification and a published subprocessor list; but the contracting entity is InnoCraft Ltd in Wellington, New Zealand, and the support and payment chain includes Help Scout in the USA, Paddle in the UK and USA, and US-based Twilio, Atlassian and HubSpot. What secures this level for my procurement office is the documented On-Premise edition: open-source, on our own servers in the country of our choice, with subprocessors declared not applicable, so every visitor record stays on the municipal chain. 3 4 7 8 17
The Skeptic
Cloud runs on named EU infrastructure — AWS in Frankfurt with backups in Dublin, with the statement that no data is transferred to the US — under a published DPA, listed subprocessors with locations, ISO 27001, an EU representative and a Hamburg DPO; but the contracting entity is InnoCraft Ltd in New Zealand, the host is a US-headquartered provider under the CLOUD Act, and support (Help Scout, USA) and payments (Paddle, UK and USA) run through non-EU providers, covered by the New Zealand adequacy decision and standard contractual clauses. The GPL On-Premise edition, keeping every record in the customer's own MySQL in a country of choice, is the fully documented way out of that chain. 3 4 6 7 8
Pricing transparency
Show reasoningHide reasoning
How this is scored
Whether a buyer can compute the real annual cost from public pages alone: price per tier by monthly page views or events, what happens when traffic exceeds the tier, the number of sites and users included, which features (e-commerce, funnels, raw export, API, SSO, longer retention) cost extra, the free tier and its limits, the self-hosted edition and its support, minimum term and setup.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or a free tier exists, but how cost scales with traffic, sites or features is unclear.
5 — Tiers are public with their price per traffic band and main inclusions, but at least one commonly needed piece (overage, extra sites, raw export, SSO, longer retention) is unpriced or "on request".
8 — Every tier priced publicly with its scaling rule (page views, events, sites, users), overage handling stated, add-ons priced, the self-hosted edition's cost or licence stated, minimum term and VAT treatment stated.
10 — Complete price computability: annual cost derivable for a given traffic volume, site count and feature set, with every add-on, setup, support and overage fee and the cancellation and data-return terms published.
The E-Commerce Marketing Lead
The pricing page names a tier at 22 EUR per month excluding tax with 30 websites, 30 team members and 24 months of raw-data retention included, an exact overage rule of 5,000 additional hits for 2.2 EUR, prorated plan changes, two months free on annual billing, a 21-day trial with no credit card, and the Data Warehouse Connector add-on from 5 EUR per month, while On-Premise is free to download forever. The captured pages do not show the full tier ladder for higher traffic, the minimum term, or what premium plugins cost on a self-hosted install, so I cannot yet compute the complete annual cost for every scenario. 3 4 6 11
The Data Protection Officer
The Business plan is published at 22 EUR per month excluding tax with its allowances spelled out (30 websites, 30 team members, 24-month raw data retention), overage at 5,000 hits for 2.2 EUR, annual billing giving two months free, a priced add-on connector from 5 EUR per month, prorated plan changes, a 21-day free trial without credit card, and an on-premise edition that is free to download. The captured pages show only this single tier price; the hit volume a tier includes, the other tiers, and any minimum term are not stated, so a buyer cannot yet compute the full annual cost. 4 6
The Agency Developer
The Cloud business plan is public at 22 EUR Per month (excl. tax) with a clear growth rule — 5,000 additional hits for 2.2 EUR (excl. tax) — plus per-plan allowances for websites, users, goals and segments, 2 months free with annual billing, heatmaps metered at 1,500 pageviews and 150 session recordings per month, a Data Warehouse Connector starting from 5 EUR per month, and a free on-premise download. We found no public information on the prices of the other tiers, the premium plugins, or a minimum term, so a full year for a forty-site portfolio is not computable from these pages alone. 4 6
The Growth Analyst
The pricing page gives a Business plan at 22 EUR Per month (excl. tax), overage priced at 5,000 for 2.2 EUR (excl. tax), explicit allowances (30 websites, 30 team members, 24-month raw data retention, report data forever), all features included in Cloud plans, two months free on annual billing, prorated plan changes, a 21-day trial without credit card, and On-Premise free to download, with the Data Warehouse Connector starting from 5 EUR per month. What keeps this below the top band: we found no public prices for the premium plugins such as SAML single sign-on or attribution on the captured pages, and no minimum contract term is stated. 4 6
The Public-Sector Site Owner
Most figures are public: 22 EUR per month excluding tax for the Business plan, additional hits at 5,000 for 2.2 EUR excluding tax, two months free on annual billing, prorated plan changes, 30 websites and 30 team members included, the Data Warehouse Connector from 5 EUR per month, and a free GPL download for the self-hosted edition. I found no full tier ladder, no minimum term and no prices for the premium plugins on the captured pages, so the annual cost for our traffic is not fully computable. 1 4 6 8
The Skeptic
The captured pricing page shows a Business plan at 22 EUR per month (excl. tax) with allowances itemised — 30 websites, 30 team members, 24-month raw data retention, heatmap and recording quotas — overage priced at 5,000 additional hits for 2.2 EUR (excl. tax), two months free on annual billing, prorated plan changes, a 21-day trial without credit card, the self-hosted edition free to download, and the Data Warehouse Connector from 5 EUR per month. Not shown on the captured pages: the full tier ladder with prices, a minimum term, or prices for premium plugins such as Funnels and SAML. 2 3 4 6 11
European sovereignty — proven facts
0 of 6 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined ⚠ unverified | — | uncited Report an error |
|---|---|---|---|
| Hosting location | Not determined ⚠ unverified | — | uncited Report an error |
| Hosting options | Not determined ⚠ unverified | — | uncited Report an error |
| Open source | Not determined ⚠ unverified | — | uncited Report an error |
| Data processing agreement | Not determined | — | uncited Report an error |
| Transfer impact assessment | Not determined | — | uncited Report an error |
Questions about Matomo
Is Matomo European?
No. whats-best.ai classifies Matomo as Rest of world.
Where does Matomo store data?
The default storage location for customer data is not stated on the vendor’s pages as of 1 Nov 2026. The vendor’s pages mention Europe as hosting location, per the vendor’s page captured 29 Oct 2026.
Does Matomo have a free plan?
Not stated on the vendor’s pages as of 1 Nov 2026.
What are the best alternatives to Matomo?
As of 4 Nov 2026, the panel rates Piwik PRO Analytics Suite (3.5/5), Pirsch Analytics (3.5/5) and etracker Analytics (3/5) highest among the other 17 Web Analytics products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Piwik PRO Analytics Suite (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Matomo alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 29 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Open source, Legal entity, Hosting location, Hosting options. Not confirmed on the vendor’s own pages as captured.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- 4 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 3 subprocessors facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 pricing facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material. Know more? Tell us
- 4 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown. Know more? Tell us
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement. Know more? Tell us
Sources (20)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage matomo.org Checked 29 Oct 2026 Details →
- 2 Features page matomo.org Checked 29 Oct 2026 Details →
- 3 Features page (GDPR and consent) matomo.org Checked 29 Oct 2026 Details →
- 4 Features page (self-hosted edition) matomo.org Checked 29 Oct 2026 Details →
- 5 Integrations page matomo.org Checked 29 Oct 2026 Details →
- 6 Pricing page matomo.org Checked 29 Oct 2026 Details →
- 7 Privacy policy matomo.org Checked 29 Oct 2026 Details →
- 8 Data processing agreement (dpa) matomo.org Checked 29 Oct 2026 Details →
- 9 Traffic, sources & campaign reports — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 10 Traffic, sources & campaign reports — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 11 Goals, events, funnels & e-commerce — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 12 Goals, events, funnels & e-commerce — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 13 Consent-free operation & data minimisation — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 14 Consent-free operation & data minimisation — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 15 Data access, export & self-hosting — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 16 Data access, export & self-hosting — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 17 Installation, integrations & performance — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 18 Installation, integrations & performance — found from sitemap matomo.org Checked 29 Oct 2026 Details →
- 19 Security / trust page — found from the homepage matomo.org Checked 1 Nov 2026 Details →
- 20 Open-source licence page — found from the homepage matomo.org Checked 1 Nov 2026 Details →